Computer security software and hardware are used to inspect downloadables, to determine if they are malicious. The term “downloadable” refers generally to an executable application program, which is downloaded from a source computer and run on a destination computer. There are many different types of malicious downloadables, including malware, phishing, spyware, Trojan horses, viruses and worms. Malicious downloadables often enter an internal computer network from an external network, and infect all or most of the computers in the internal network once they break in. As such, computer security systems often employ gateway computers to scan and filter incoming downloadables.
Scanning downloadables at a gateway computer may be performed by running the programs; however, running the programs on the gateway computer instead of on the computer in the internal network for which the programs are intended, may result in the gateway computer failing to detect exploits in the downloadables.
Scanning downloadables at a gateway computer may also be performed by analyzing the programs. Assignee's U.S. Pat. No. 6,092,194 describes such a gateway security system.
When analyzing downloadables, scanners generally search for computer operations that are potentially suspicious. For example, if a suspect downloadable invokes a function call that writes to a file system or opens a network connection or changes a registry entry, such behavior raises a warning flag for potentially malicious activity. A security system may block a downloadable from reaching an internal network if the downloadable includes a suspicious computer operation. However, most non-malicious downloadables use these same computer operations in an innocuous way, and such a security system may block both good and bad downloadables from reaching the internal network.
Consider, for example, a function that deletes a file in the file system. Many safe programs, such as software installation programs, generate temporary files during execution, and delete the temporary files upon completion. However, a malicious program may delete critical operating system files. A security system that blocks downloadables which invoke a function to delete a file would block safe downloadables in addition to the malicious ones.
Consider, for example, a downloadable that includes the following simple JavaScript source code:
<SCRIPT LANGUAGE=“JavaScript”>var b = new ActiveXObject(“Msxml2.XMLHTTP”);exploit data = “SSSSSSSSSSSSSSSSSSSSSS exploit”;b.setRequestHeader(exploit data);</SCRIPT>
This source code initiates a new Msxml2.XMLHTTP ActiveX object, and invokes the object's method setRequestHeader( ). An Msxml2.XMLHTTP object is a standard object built into the Microsoft XML parser. The Msxml2.XMLHTTP object is an important part of the Ajax web development technique, and is used to implement responsive and dynamic web applications. It is used on a client side web page to grab information from the server, process it, and use the information on the current web page (as opposed to having to reload a web page).
The method setRequestHeader( ) is generally a safe function that simply adds an HTTP header to a request. The following code snippet shows how setRequestHeader( ) is used, for example, to set the HTTP Content-Type header to ‘text/xml’ before sending a request body.
var oReq = new XMLHttpRequest( );oReq.open(“POST”, sURL, false);oReq.setRequestHeader(CONTENT, “text/xml”);oReq.send(sRequestBody);As such, the example JavaScript above appears innocuous.
However, the input parameter to setRequestHeader( ) in the example JavaScript code above is only evaluated at run-time, and a code exploit may be triggered in the process of evaluating the input parameter. More generally, input parameters to function calls, even for safe functions, are potential hiding places for code exploits. Since input parameters may only be determined at run-time, such code exploits may go undetected when scanning downloadables.
It would thus be of advantage for a security system to be able to validate input parameters that are evaluated at run-time. It would be of further advantage for a security system to be able to determine if a given input parameter will exploit a non-malicious function, prior to actually executing the non-malicious function with the given input parameter.